34379 matches found
CVE-2026-77994
creationtimestamp| type| source ---|---|--- 2026-08-24 08:43:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4oh35o677aslv 2026-08-24 08:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtswdbvcuz2m 2026-08-24 09:00:27+00:00| seen|...
CVE-2026-78255
The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...
CVE-2026-78251
creationtimestamp| type| source ---|---|--- 2026-08-24 07:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117149310942090116 2026-08-24 07:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtsruvafgr2c 2026-08-24 08:17:44+00:00| seen|...
EUVD-2026-64746
The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...
CVE-2026-78255 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media
The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...
CVE-2026-78255
The HTTP media server embedded in affected DJI drone models exposes stored photos and videos through the /v2 endpoint without authenticating the requesting client . Because filenames follow a predictable pattern , an attacker who joins the drone's internal network can enumerate valid filenames an...
PT-2026-79837
Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...
postgresql17-17.11-1.1 on GA media (moderate)
postgresql17-17.11-1.1 on GA media Announcement ID: openSUSE-SU-2026:11555-1 Rating: moderate Cross-References: CVE-2026-14662 CVE-2026-14663 CVE-2026-14664 CVE-2026-14666 CVE-2026-14668 CVE-2026-14669 CVE-2026-14670 CVE-2026-14671 CVE-2026-14672 CVE-2026-14677 CVE-2026-14678 CVE-2026-14679...
PT-2026-79839
Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...
erlang-28.5.0.4-1.1 on GA media (moderate)
erlang-28.5.0.4-1.1 on GA media Announcement ID: openSUSE-SU-2026:11559-1 Rating: moderate Cross-References: CVE-2026-28808 CVE-2026-42789 CVE-2026-42790 CVE-2026-42791 CVE-2026-42792 CVE-2026-47078 CVE-2026-48855 CVE-2026-48856 CVE-2026-48858 CVE-2026-48860 CVE-2026-49759 CVE-2026-49760...
OPENSUSE-SU-2026:11580-1 MozillaFirefox-154.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-154.0-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-80628
These are all security issues fixed in the MozillaFirefox-154.0-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-78003
creationtimestamp| type| source ---|---|--- 2026-08-22 09:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117138340214723722 2026-08-22 09:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtnvxy3zpx2c 2026-08-22 09:03:42+00:00| seen|...
CVE-2026-77002
creationtimestamp| type| source ---|---|--- 2026-08-22 07:30:23+00:00| seen| https://infosec.exchange/users/offseq/statuses/117137986193455712 2026-08-22 07:30:25+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtnqwyfch424 2026-08-23 16:40:04+00:00| seen|...
CVE-2026-77000
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...
CVE-2026-19093
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...
CVE-2026-77000
The WP Social Media Login WordPress plugin (through 1.0.6 ) fails to verify that a social login was actually completed with the identity provider before authenticating a visitor. The CVELIST entry identifies the specific flow as the Twitter login flow . An unauthenticated attacker can log in as a...
EUVD-2026-64225
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...
CVE-2026-77000 WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...
EUVD-2026-64220
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...